PopSaveHiberContext
NTSTATUS __stdcall PopSaveHiberContext(POP_HIBER_CONTEXT *HiberContext){
__int64 Number;
__int64 v3;
int v4;
bool v5;
PO_MEMORY_IMAGE *v6;
POP_HIBER_CONTEXT *v7;
unsigned int v8;
_DWORD *v9;
_DWORD *v10;
UINT64 *v11;
_RTL_BITMAP *v12;
_DUMP_STACK_CONTEXT *v13;
VOID *v14;
unsigned __int64 v15;
int v16;
void *v17;
unsigned __int64 v18;
POP_HIBER_CONTEXT *v19;
UINT64 v20;
UINT64 v21;
char *v22;
_QWORD *v23;
PVOID v24;
int v25;
unsigned int WakeCheck;
unsigned int v27;
INT64 v28;
POP_HIBER_CONTEXT v29;
__int64 v30;
__int64 v31;
unsigned __int64 v32;
unsigned __int64 v33;
unsigned __int64 v34;
POP_HIBER_CONTEXT i;
int v36;
int v37;
__int64 v38;
__int64 v39;
unsigned int v40;
__int64 v41;
unsigned int v42;
INT64 v43;
POP_HIBER_CONTEXT v44;
__int64 v45;
unsigned __int64 v46;
UINT64 v47;
UINT8 v49;
char ReasonCodes[12];
__int128 v51;
__int128 v52;
__int128 v53;
__int128 v54;
__int128 v55;
__int128 v56;
__int64 v57;
_OWORD v58[5];
__int128 v59[5];
char Mdl[312];
int v61;
v57 = 0i64;
v56 = 0i64;
memset(Mdl, 0i64, sizeof(Mdl));
*(_DWORD *)ReasonCodes = 0;
Number = KeGetCurrentPrcb()->Number;
if( (_DWORD)Number )
{
if( (HvlpFlags & 2) != 0 )
{
if( _InterlockedIncrement(HiberContext + 5) )
{
do
_mm_pause();
while( HiberContext[5] );
}
if( PoResumeFromHibernate )
return 1073742484;
if( _InterlockedIncrement(HiberContext + 6) )
{
do
_mm_pause();
while( HiberContext[6] );
}
}
}
else
{
PopCheckpointSystemSleep(PopSleepCheckpointSaveHiberContextBegin);
}
if( (unsigned int)Number >= HiberContext[64] )
return 0;
if( !(_DWORD)Number )
{
*(&stru_140C23628 + 669) = 0;
_disable();
if( (v61 & 0x200) != 0 )
PopInternalError((PVOID)0xA18D9);
if( *(&stru_140C23628 + 2332) < 0 )
{
v49 = 0;
}
else
{
v49 = IoDumpStackResumeCapable((UINT64 *)ReasonCodes);
if( v49 )
goto LABEL_13;
}
dword_140C23508 |= 4u;
byte_140C23481 = 1;
LABEL_13:
if( (unsigned int)PshedArePluginsPresent() )
{
dword_140C23508 |= 8u;
byte_140C23481 = 1;
}
if( !(unsigned __int8)off_140C00850[0]() )
{
dword_140C23508 |= 1u;
byte_140C23481 = 1;
}
LOBYTE(v4) = KeActiveTracepointsPresent();
if( v4 )
{
dword_140C23508 |= 0x40u;
byte_140C23481 = 1;
}
v5 = (_BYTE)HvlHypervisorConnected == 0;
v6 = (PO_MEMORY_IMAGE *)*((_QWORD *)HiberContext + 25);
*((_QWORD *)HiberContext + 20) = &v56;
*((_QWORD *)HiberContext + 22) = &qword_140CECAD0;
*((_BYTE *)HiberContext + 2) = 1;
if( !v5 )
{
HvlDisableEnlightenment(HvlDisableReasonHibernate);
off_140C007A0[0]();
if( (HvlpFlags & 2) != 0 )
{
_InterlockedIncrement(HiberContext + 5);
while( HiberContext[5] != (_DWORD)KeNumberProcessors_0 )
_mm_pause();
*(_QWORD *)&v51 = qword_140CECCB8;
*((_QWORD *)&v51 + 1) = qword_140CECC58;
*(_QWORD *)&v52 = qword_140CECC60;
*((_QWORD *)&v52 + 1) = qword_140CECC50;
*(_QWORD *)&v53 = qword_140CECC70;
*((_QWORD *)&v53 + 1) = qword_140CECC68;
v54 = xmmword_140CECC98;
v55 = xmmword_140CECCA8;
if( *((_BYTE *)HiberContext + 452) )
{
v58[0] = v51;
v58[2] = v53;
v58[1] = v52;
v58[4] = v55;
v58[3] = v54;
v36 = HvlPrepareForSecureHibernate(v58);
}
else
{
v59[0] = v51;
v59[2] = v53;
v59[1] = v52;
v59[4] = v55;
v59[3] = v54;
v36 = HvlPrepareForHibernate(
v59,
&v6->HvPageTableRoot,
&v6->HvEntryPoint,
&v6->HvReservedTransitionAddress,
&v6->HvReservedTransitionAddressSize);
}
v37 = v36;
if( v36 < 0 )
{
PopInternalAddToDumpFile(*((VOID **)HiberContext + 21), 0x178ui64, 0i64);
KeBugCheckEx(0xA0u, (PVOID)0xC, (PVOID)v37, *((PVOID *)HiberContext + 21), 0i64);
}
HiberContext[5] = 0;
_InterlockedIncrement(HiberContext + 6);
while( HiberContext[6] != (_DWORD)KeNumberProcessors_0 )
_mm_pause();
HiberContext[5] = KeNumberProcessors_0;
HiberContext[6] = 0;
}
if( *((_BYTE *)HiberContext + 452) )
HvlDiscardSecurePagesFromHibernation(HiberContext);
else
HvlDiscardPagesFromHibernation(HiberContext);
}
++v6->Signature;
v7 = HiberContext + 12;
v8 = 0;
v9 = (_DWORD *)*((_QWORD *)HiberContext + 7);
v10 = (_DWORD *)*((_QWORD *)HiberContext + 5);
if( (HiberContext[12] & 0xFFFFFFE0) != 0 )
{
do
{
++v8;
*v9++ |= *v10++;
}
while( v8 < (unsigned int)*v7 >> 5 );
}
v11 = (UINT64 *)(HiberContext + 8);
if( byte_140C23481 )
{
v12 = (_RTL_BITMAP *)(HiberContext + 8);
}
else
{
RtlCopyBitMap((_RTL_BITMAP *)HiberContext + 3, (_RTL_BITMAP *)HiberContext + 2, 0i64);
v12 = (_RTL_BITMAP *)(HiberContext + 12);
}
RtlSetAllBits(v12);
v13 = (_DUMP_STACK_CONTEXT *)*((_QWORD *)HiberContext + 21);
HiberContext[46] = 8;
IoGetDumpHiberRanges(v14, v13);
if( !byte_140C23481 )
IoNotifyDump(NotifyDumpHiberStart);
v15 = __rdtsc();
IoInitializeDumpStack(*((_DUMP_STACK_CONTEXT **)HiberContext + 21), (UINT8 *)((unsigned __int64)HIDWORD(v15) << 32));
v17 = (void *)v16;
v18 = __rdtsc();
*(&stru_140C23628 + 52) += (((unsigned __int64)HIDWORD(v18) << 32) | (unsigned int)v18) - v15;
if( (int)v17 < 0 || *(&stru_140C23628 + 583) == 1 )
{
PopCheckpointSystemSleep(PopSleepCheckpointInitializeDumpStackFailed);
PopInternalAddToDumpFile(*((VOID **)HiberContext + 21), 0x178ui64, 0i64);
KeBugCheckEx(0xA0u, (PVOID)0xC, v17, *((PVOID *)HiberContext + 21), 0i64);
}
PopMarkComponentsBootPhase((_POP_HIBER_CONTEXT *)HiberContext);
v19 = (POP_HIBER_CONTEXT *)*((_QWORD *)HiberContext + 8);
PoHiberInProgress = 1;
if( v19 != HiberContext + 16 )
{
do
{
v20 = *((_QWORD *)v19 + 4);
v21 = *((_QWORD *)v19 + 3);
v22 = (char *)*((_QWORD *)v19 + 5);
v19 = *(POP_HIBER_CONTEXT **)v19;
for( *((_QWORD *)HiberContext + 11) += v20 - v21;
v21 < v20;
v21 += (unsigned __int64)*(unsigned int *)&Mdl[40] >> 12 )
{
PopCreateDumpMdl((_POP_HIBER_CONTEXT *)HiberContext, (_MDL *)Mdl, v21, v20);
memmove(v22, *(const VOID **)&Mdl[24], *(size_t *)&Mdl[40]);
v22 += *(unsigned int *)&Mdl[40];
}
}
while( v19 != HiberContext + 16 );
v11 = (UINT64 *)(HiberContext + 8);
}
PopResetRangeEnum((_POP_HIBER_CONTEXT *)HiberContext);
v23 = (_QWORD *)*((_QWORD *)HiberContext + 20);
v24 = qword_140C23458;
*v23 = qword_140C23458;
v23[1] = v24;
v23[2] = 0i64;
*(_QWORD *)&ReasonCodes[4] = __rdtsc();
v25 = PopWriteHeaderPages(HiberContext, v6);
if( v25 >= 0 )
{
WakeCheck = v6->WakeCheck;
if( *((_BYTE *)HiberContext + 452) )
{
v38 = *(&stru_140C23628 + 702);
v39 = (unsigned int)(HiberContext[62] + 2);
HiberContext[46] = 3;
v6->FirstSecureRestorePage = v39 + ((unsigned __int64)(4 * v38 + 4095) >> 12);
PopWriteSecurePages((ULONG_PTR)HiberContext);
*(&stru_140C23628 + 101) = (unsigned int)HiberContext[63];
}
HiberContext[46] = 4;
*((_QWORD *)HiberContext + 12) = v7;
v27 = RtlNumberOfClearBits((UINT64 *)HiberContext + 6);
v28 = SharedContext;
v29 = HiberContext[70];
v30 = *((_QWORD *)HiberContext + 34);
v31 = (v27 + *((_QWORD *)HiberContext + 11)) << 12;
memset((VOID *)SharedContext, 0i64, 0x40u);
*(_DWORD *)(v28 + 24) = 0;
*(_QWORD *)v28 = v30;
*(_DWORD *)(v28 + 8) = v29;
*(_QWORD *)(v28 + 16) = v31;
*(&stru_140C23628 + 102) = 0i64;
*(&stru_140C23628 + 103) = 0i64;
HiberContext[82] = 0;
*((_QWORD *)HiberContext + 43) = 0i64;
if( v49 && *(_QWORD *)(*((_QWORD *)HiberContext + 21) + 128i64) )
*((_BYTE *)HiberContext + 392) = 1;
v32 = (4 * (unsigned __int64)*(&stru_140C23628 + 702) + 4095) >> 12;
v33 = v32 + (unsigned int)(HiberContext[62] + 2);
LOBYTE(v32) = 1;
v34 = (unsigned int)HiberContext[63] + v33;
v6->FirstBootRestorePage = v34;
*((_QWORD *)HiberContext + 47) = v34 << 12;
*((_BYTE *)HiberContext + 4) = 1;
PopWriteHiberImage(HiberContext, v32);
_InterlockedIncrement(HiberContext + 3);
for( i = HiberContext[64]; HiberContext[3] != i; i = HiberContext[64] )
_mm_pause();
v40 = 0;
if( i )
{
do
{
v41 = v40++;
v41 <<= 7;
*(&stru_140C23628 + 102) += *(_QWORD *)(v41 + *((_QWORD *)HiberContext + 33) + 56);
*(_QWORD *)(v41 + *((_QWORD *)HiberContext + 33) + 56) = 0i64;
}
while( v40 < HiberContext[64] );
}
*(&stru_140C23628 + 104) = *(&stru_140C23628 + 108);
*(&stru_140C23628 + 106) = *(&stru_140C23628 + 218);
*(&stru_140C23628 + 108) = 0i64;
*(&stru_140C23628 + 218) = 0;
HiberContext[46] = 5;
*((_QWORD *)HiberContext + 12) = v11;
*((_QWORD *)HiberContext + 14) = 0i64;
v42 = RtlNumberOfClearBits(v11);
v43 = SharedContext;
v44 = HiberContext[70];
v45 = *((_QWORD *)HiberContext + 34);
v46 = (unsigned __int64)v42 << 12;
memset((VOID *)SharedContext, 0i64, 0x40u);
*(_DWORD *)(v43 + 24) = 0;
*(_QWORD *)v43 = v45;
*(_DWORD *)(v43 + 8) = v44;
*(_QWORD *)(v43 + 16) = v46;
v6->FirstKernelRestorePage = (unsigned __int64)(*((_QWORD *)HiberContext + 47) + 4095i64) >> 12;
HiberContext[3] = 0;
*((_QWORD *)HiberContext + 43) = 0i64;
PopWriteHiberImage(HiberContext, 0i64);
HiberContext[46] = 7;
PopWriteChecksumPages((_POP_HIBER_CONTEXT *)HiberContext);
v47 = *(_QWORD *)&ReasonCodes[4];
HiberContext[46] = 6;
PopWriteImageHeader((_POP_HIBER_CONTEXT *)HiberContext, v6, WakeCheck, v47);
v25 = HiberContext[47];
if( v25 >= 0 )
{
if( SystemState == EffectiveState )
{
if( (*(&stru_140C23628 + 1164) & 0x8000) == 0 )
DbgUnLoadImageSymbols(0i64, (VOID *)0xFFFFFFFFFFFFFFFEi64, 0);
VslNotifyShutdown(1u);
}
if( (*(&stru_140C23628 + 1164) & 0x1000) != 0 )
{
v25 = -1073741632;
}
else
{
v25 = 0;
if( (*(&stru_140C23628 + 2332) & 0x10) != 0 )
{
v25 = 1073742484;
LABEL_84:
PopCheckpointSystemSleep(PopSleepCheckpointSaveHiberContextEnd);
off_140C008C8[0]();
return v25;
}
}
}
}
KdPowerTransition(PowerDeviceD3);
if( v25 >= 0 && SystemState == PowerSystemHibernate )
{
PopNotifyShutdownListener();
HvlConfigureMemoryZeroingOnReset(0i64);
PopSetMemoryOverwriteRequestAction();
}
goto LABEL_84;
}
while( !*((_BYTE *)HiberContext + 4) )
_mm_pause();
v3 = Number << 7;
PopCompressHiberBlocks(HiberContext, (POP_PER_PROCESSOR_CONTEXT *)(v3 + *((_QWORD *)HiberContext + 33)), 1u);
if( _InterlockedIncrement(HiberContext + 3) )
{
do
_mm_pause();
while( HiberContext[3] );
}
return PopCompressHiberBlocks(HiberContext, (POP_PER_PROCESSOR_CONTEXT *)(v3 + *((_QWORD *)HiberContext + 33)), 0);
}Referenced by:
PopSaveHiberContextWrapper